Privacy Policy

Version 2026-10-10 · last updated 10 October 2026

This Privacy Policy explains what personal data Shardcrown collects, why, how long we keep it and what your rights are. We collect as little as we can to run a fair online game.

1. Who is responsible

The controller of your personal data is [Company name], registered with the Dutch Chamber of Commerce (KvK) under number [KvK number], VAT number [VAT number (btw-id)], [Postal address]. Contact for anything about privacy: [Contact email].

2. What we collect, why, and on what legal basis

Data	Why	Legal basis (GDPR art. 6)
Account: username, password (stored only as a salted scrypt hash), when you signed up and were last seen, the terms version you accepted	To give you an account and keep it yours	Contract (b)
Email address (optional, or from Google/Discord sign-in)	Sign-in by email, password reset links, important account mails	Contract (b)
Google / Discord sign-in: the provider's account id, name and email it gives us	To let you sign in with them; to show your character on our Discord (if you link it)	Contract (b)
Your character and play: everything you do in the game (stats, items, marks, trades, fights, factions, journal)	That is the game; other players see the public parts (profile, rankings, faction pages)	Contract (b)
Chat, messages, profile and faction texts	To deliver them; to handle reports and keep the game safe	Contract (b), legitimate interest in a safe community (f)
Security and anti-cheat data: a salted hash of your IP address and of a random device cookie per sign-in, action timing patterns, flags raised by our anti-bot checks, staff notes	To stop cheating, bots, alt abuse, real-money trading and attacks	Legitimate interest (f)
Purchases: what you bought, when, the order reference and whether it was a gift	To deliver what you bought, handle refunds and keep accounts the law requires	Contract (b), legal obligation (c)
Waitlist email (only if you sign up for it)	To tell you when the game opens	Consent (a)
Where you first came from: the tag of the link you arrived by (for example `?ref=discord` or `utm_source=newsletter`) or the name of the website that linked to us, stored with your account when you sign up	To learn which channels bring new players; we only look at totals	Legitimate interest (f)
Analytics (only if you allow analytics cookies): pages visited on this website, how you arrived, and a few milestones (sign-up started or finished, tutorial finished, level 5 and 10 reached, a purchase and its amount)	To see how visitors find and use Shardcrown and improve it	Consent (a)

We don't collect payment details: card numbers and bank details go straight to Paddle, who processes the payment as Merchant of Record under its own privacy policy. We don't sell your data, we don't show ads and we never use advertising cookies. Analytics cookies are used only if you allow them (section 5).

Automated checks. Our anti-bot checks flag unusual patterns (for example actions at machine-regular intervals). A flag is never a ban by itself: a person on our staff looks at it before anything happens to your account.

3. How long we keep it

Account and character: as long as your account exists. When you delete your account, see section 6.
Chat in public channels: 7 days. Private messages: as long as both accounts exist.
Notifications: 30 days (at most 100). Road log: 30 days.
IP and device hashes: we keep them at most 90 days after they were last seen. Action timing data: 72 hours. Anti-bot flags: up to 12 months after they are resolved.
Sessions: until you sign out, or 30 days after your last visit.
Purchase records: 7 years, as Dutch tax law requires.
Server logs (requests with your account number, never your IP or passwords): at most 30 days.
Waitlist emails: until the game opens to everyone or you ask us to remove yours.
Where you first came from: as long as your account exists.
Analytics (only with your consent): Google Analytics keeps event data for 14 months, then deletes it. Its cookies last up to 2 years in your browser; when you refuse or withdraw consent we remove them.

4. Who else processes your data

We use a few services that process data for us (processors) or alongside us:

Hosting: [Hosting provider and location]: runs the game server and its database.
Cloudflare (if in use): delivers the website and protects it from attacks; it sees your IP address.
Mail: [Mail provider]: sends our emails (only if you gave us an email).
Paddle: payments, invoices and VAT, as Merchant of Record (its own privacy policy applies).
Google Analytics 4 (Google Ireland Ltd.): only if you allow analytics cookies. It receives the pages you visit on this website, how you arrived and the milestones listed in section 2, with a random browser id from its cookie; never your name, username, email, account number or character. Google Analytics does not log or store IP addresses. We turned off Google signals, advertising features and data sharing for ads; data is kept 14 months.
Google and Discord: only if you choose to sign in with them or link your account. Our Discord bot reads which Discord account is linked to which character to give the Verified Player role; it never sees your password or email.

Some of these companies are based outside the European Economic Area; transfers are covered by the EU's adequacy decisions (such as the EU-US Data Privacy Framework) or standard contractual clauses.

5. Cookies and local storage

Necessary cookies (always on; the game can't work or stay safe without them):

sb_session: keeps you signed in (essential).
sb_device: a random device id that helps us find cheating and account abuse (security).
a short-lived cookie during Google/Discord sign-in (security).
sb_consent: remembers your cookie choice (6 months).

Our own sign-up cookies (first-party, never shared, no tracking across other websites):

sb_ref and sb_utm: remember the tag of the link you first arrived by, or the website that linked to us, until you sign up (30 days). The tag is stored with your new account as "where you first came from" (section 2).
sb_invite: a friend's invite link, for the referral rewards (7 days).

Analytics cookies (only if you allow them): when Google Analytics is switched on for this website, a banner asks on your first visit; "Reject" and "Accept" are equally easy, and nothing from Google loads until you accept. With your consent Google Analytics sets _ga and _ga_ + an id (a random browser id, up to 2 years). You can change your choice any time with Cookie settings at the bottom of every page of this website or on the Account page in the game; refusing removes these cookies.

The game also keeps your preferences (for example sound, menu and chat settings) in your browser's local storage; they never leave your device. We use no advertising cookies.

6. Your rights

You have the right to access your data, to get a copy of it (portability), to have it corrected, to have it deleted, to restrict or object to processing based on legitimate interest, and to withdraw consent at any time.

Download my data: on the Account page in the game you can download a copy of your account and character data at any time.
Delete my account: on the Account page. Your account is closed at once: your username, email, sign-ins, sessions, IP and device hashes are deleted, your character is renamed, and your chat, messages and profile texts are erased. Game records that other players' history depends on (trades, fights, rankings) stay, without your name. Purchase records stay for the 7 years tax law requires.
For anything else, email [Contact email]. We answer within one month.

You may also complain to a data protection authority, in the Netherlands the Autoriteit Persoonsgegevens (autoriteitpersoonsgegevens.nl), or the one where you live.

7. Children

Shardcrown is for players aged 16 and older. We don't knowingly collect data of younger children; if you think a child under 16 has an account, tell us and we delete it.

8. Security

Passwords are stored only as strong hashes, sessions are random and revocable, IP addresses and device ids are stored only as salted hashes, and only a small staff team can see account details, every staff action being logged.

9. Changes

If we change this policy in a way that matters, we tell you in the game before it applies.